fifa-online[.]com

The domain fifa-online.com was registered on June 12, 2026 through GoDaddy, LLC and is served from an AWS Global Accelerator endpoint located in the United States (IP 76.223.67.189). The site returns HTTP 200 responses and presents a valid GoDaddy‑issued DV certificate chained to the GoDaddy TLS Intermediate CA DV - R1v1. Infrastructure analysis shows the web server runs Nginx with the OpenResty module.

VirusTotal has recorded detections from 16 of 95 scanned security engines, and the domain is listed on PhishDestroy and one additional public blocklist. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious activity. AlienVault OTX references the domain in five separate threat pulses, reinforcing its association with known phishing campaigns.

The observed characteristics align with a generic impersonation campaign targeting users of the FIFA Online brand. The site’s content mirrors legitimate login pages, aiming to harvest credentials, although the exact payload and exfiltration mechanisms have not been publicly disclosed. No evidence of additional infrastructure, such as command‑and‑control servers or malware drops, has been identified, leaving the full attack chain uncertain.

Defenders should block the resolved IP address 76.223.67.189 and add fifa-online.com to URL filtering and sinkhole lists. Email gateways should be configured to flag messages containing this domain or its variations. Continuous monitoring of DNS queries for the domain and rapid re‑evaluation of threat intelligence feeds are advised, as the infrastructure may shift to new cloud endpoints.